The use of video surveillance systems has long become indispensable for companies in the free economy. But the term “surveillance” still initially sounds alienating and has negative connotations for many people.

However, it must be taken into account here: As a rule, video surveillance does not take place to the detriment of those being monitored. Accordingly, despite strict data protection precautions, it is permissible per se. In the following article you will learn in which areas video surveillance is legally justified and what you as an employer have to consider.

What to watch out for in surveillance and data protection

In general, if images of individuals are collected, for example when entering internal company buildings, this constitutes processing of personal data. This consequently means that the scope of the General Data Protection Regulation (abbreviated to DSGVO) is also affected.

Although there is a specific requirement for video surveillance in Germany, as stated in section 4 of the Federal Data Protection Act, it should be noted that the Federal Administrative Court ruled in March 2019 that the previous standard does not comply with European requirements and should therefore not be used.We therefore recommend that in any case you not only consider the Federal Data Protection Act in your video surveillance, but also comply with the requirements of the GDPR accordingly.

New guidance from the data protection authority

In July 2020, the Assembly of the German Data Protection Authority (abbreviated to DSK) set out which specific requirements should be met for permissible video surveillance.

The following applies in advance: Your company should already deal with the applicability of all data protection regulations before installing surveillance cameras.

What all counts as video surveillance?

The supervisory authority includes in the term video surveillance both general video observation, where consequently a live transmission of the images on a monitor is to be followed, and video recording, where recordings can be stored and read out afterwards.

Many small companies often rely on so-called camera dummies. Since no video observation is possible with these, no transmission of personal data takes place in the conventional sense. Accordingly, the provisions of the BDSG and the GDPR do not apply here either.

Note, however: In the past, there have already been some civil lawsuits dealing with the dummy cameras. For example, plaintiffs have specifically spoken out against the use of dummies because they can trigger inadmissible surveillance pressure.

At what point is video surveillance in the company lawful?

From the perspective of data protection law in the use of video surveillance, the balancing of interests according to Article 6(1)(f) DSGVO is a decisive legal basis that companies must carry out before monitoring customers or employees.

The following applies: If the processing of the data is necessary to protect the interests of the company, video surveillance is permissible according to the GDPR. The personal interests or fundamental freedoms of the data subjects must consequently be subordinate to the interests of the company in a legitimate balancing of interests.

Important: The balancing of interests must be carefully documented by the company and carried out before installing surveillance cameras.

What is considered a legitimate interest of companies?

A legitimate interest for the maintenance of video surveillance can be of a non-material, economic or legal nature. Only those interests that are lawful and clearly and comprehensibly formulated are justified here.

A small example: An owner of a property can in principle take preventive and repressive measures that contribute to the protection of his property. Protection against theft is also considered a legitimate interest.

However, according to the data protection authorities, in order to justify these protective measures, there must be concrete facts from which a serious risk situation arises.

Video surveillance must be necessary

In the case of companies, video surveillance as data processing is considered “necessary” for the operation. Accordingly, companies must check in advance whether the monitoring measures are necessary to fulfil a defined purpose.

Here, the data protection authorities have strict precautions. For example, each camera is checked individually to see whether it can be restricted to certain operating hours or to certain coverage areas without jeopardising the surveillance purpose.

In principle, the following applies: Video surveillance is only actually necessary if the specified purpose cannot also be fulfilled by other means. In this context, monitoring on an ad hoc basis is always preferable to permanent monitoring.

Consider transparency

Every one of us has noticed the signs for video surveillance in the entrance of a building. Nowadays, these are available in all kinds of colours and variations – and are also necessary.

This is because the supervisory authorities require that video surveillance as well as the name and contact details of the company be made recognisable at the earliest possible stage.

By the way, there is no legal model sign. On the website of the Lower Saxony authority, sample information signs can be downloaded that have been published by the data protection authorities.

For you as a company, this means that when people enter video-monitored areas of your company, they are made aware of the data processing so that they can adapt their behaviour accordingly.

Retention period of the videos

There is no specific time specification for this from the legal situation. As a general rule, however, data should only be stored for as long as the purpose requires it. The storage period should therefore be adapted to the respective purpose of the monitoring.

Consequently, if the data is no longer needed for the pursuit of the original purposes, the company is obliged to delete the video recordings immediately. Here, the data protection authorities assume that a storage period of up to 72 hours is generally permissible.

Video surveillance of employees in the company

In general, it is often the case that not only customers but also employees are affected by video surveillance. This is the case, for example, with cameras on entrance doors.

This is the case, for example, with cameras on entrance doors. This is mainly due to the fact that the fear of constant monitoring of their behaviour leads to a certain pressure on employees to adapt.

Accordingly, when weighing up the interests, it must be taken into account, for example, that in a workplace with little room for retreat, the interests worthy of protection and the well-being of the employees would rather outweigh the purpose of surveillance.

Note: Often employees are also unwilling to consent to constant video surveillance. It must also be taken into account that consent must always be revocable.

Video surveillance in public and non-public areas

Non-public areas

In the case of video surveillance in non-public areas, the BDSG stipulates that a declaration of consent from all persons concerned is required.

The following data protection principles must generally be observed:

• Earmarked for a specific purpose
• Voluntariness
• Informed
• Revocability

It is your responsibility as an employer to communicate the purpose of the monitoring extensively to your employees. Furthermore, workers must voluntarily consent to video surveillance and have the right to revoke this consent at any time without consequences.

Publicly accessible areas

It must be taken into account that a large number of workplaces can be assigned to a public sector. Special rules apply here according to the GDPR.

Often employers resort to monitoring your business due to the high risk of theft.

Example of public-access workplaces:

• Public parking
• Retail sales and exhibition space
• Gas stations
• Banks
• public cultural institutions
• public access roads to companies and their properties

According to the Federal Data Protection Act, video surveillance in publicly accessible workplaces is therefore permitted insofar as it is necessary for the preservation and safeguarding of house rights (§6 BDSG).

If video surveillance is introduced in a publicly accessible workplace, the camera surveillance must also be clearly recognisable as such. It is also important to point out who is responsible for the monitoring. In practice, signs are usually used for this purpose.

Is surreptitious surveillance permissible?

As a general rule, surreptitious surveillance is only permissible if there is a valid reason and must always be limited to a time period.

The form of secret surveillance may only take place in non-publicly accessible rooms. A possible reason justifying secret surveillance is, for example, the investigation of a criminal offence such as theft or similar.

However, please note: Before using a secret surveillance measure, the employer’s interest and the personal rights of the person being monitored must always be weighed against each other and the proportionality of the surveillance measure must be ensured.

It must also be checked in advance whether video surveillance is the only means of detecting a potential crime. Only if there are no alternatives to reconnaissance is surreptitious video surveillance considered a proportionate means.

Video surveillance in highly personal places always negligent

The use of video cameras for surveillance in places of the most personal sphere of life is prohibited at all times. Labour law and also the Data Protection Act provide for a lawful protection of privacy, insofar as it can be assumed that employees largely behave privately here.

The most personal areas of life include, among others:

• Sanitary facilities
• Break rooms
• Bedrooms
• Foyer

Important here: Even with the existence of a declaration of consent, the prohibition of video surveillance in highly personal places is not circumvented.

Conclusion on video surveillance in the enterprise

The most important thing for companies is this: Monitoring your building is fundamentally possible even in times of data protection regulations. Of course, the strict requirements of data protection law still apply here.

In this context, companies must be particularly sensitive when it comes to monitoring their employees. Accordingly, a weighing of interests must always take place in advance.

For detailed information on this topic, we recommend the checklist of the data protection authorities, which can provide guidance for operators of video surveillance.